Repository navigation
chore(function): remove exchange_github_app_token_with_pat route - #57630
Conversation
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Looks good. I checked it by calling the worker app directly in both checkouts: POST /exchange_github_app_token_with_pat returned 401 on the base and returns 404 with this PR. POST /exchange_github_app_token still behaves the same. Nothing left in the repo refers to the route or to MOCK_TOKEN. packages/function tests pass and its type check is clean.
Public API: removes POST /exchange_github_app_token_with_pat from api.opencode.ai and the MOCK_TOKEN env var from github/index.ts. This is not backwards compatible for anyone still calling the route: old local-testing setups (V1 opencode github run --token / mock mode with MOCK_TOKEN) now get a 404 and need to pass a PAT as TOKEN instead. Real usage looks negligible given there were no successful calls in the last 30 days. The OIDC exchange route used by the GitHub Action is unchanged.
No concerns.
1 participant
Issue for this PR
Closes #
Type of change
What does this PR do?
Removes the
POST /exchange_github_app_token_with_patroute from the api.opencode.ai worker (packages/function/src/api.ts).The route swapped a user's GitHub PAT for a GitHub App installation token. Its only real use was local testing of the GitHub action (the V1 CLI's
opencode github run --token/ mock mode, andgithub/index.ts). In the last 30 days it got about 460 calls and zero 2xx responses. Almost all of them came from probing scripts. This relates to security monitor finding #133.github/index.tsmock mode called this route whenMOCK_TOKENwas set. Mock mode now needsTOKEN(already supported, and used directly as the GitHub token). The README is updated to match.POST /exchange_github_app_token(OIDC exchange used by the GitHub Action, ~2k calls/day) is unchanged.How did you verify your code works?
bun run checkpassespackages/functiontests passScreenshots / recordings
N/A
Checklist
Added by the opencode bot (AI-generated).
Public API: removes POST /exchange_github_app_token_with_pat and the MOCK_TOKEN env var for local action testing (not backwards compatible; use TOKEN instead)